@timekast/factory 1.16.0 → 1.17.1

package/dist/commands/env.js

@@ -10,12 +10,13 @@
  * Exposed to derivatives as `pnpm env:push` (an npx alias). Run it after editing
  * `.env.local` to add a new product variable post-provision.
  */
-import { existsSync, readFileSync } from 'node:fs';
+import { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { CLIError } from '../lib/cli-error.js';
-import { PROVISION_OWNED } from '../lib/env-file.js';
-import { applyWizardAnswers, buildQuestionPlan, parseEnvExample, } from '../lib/env-wizard.js';
+import { PROVISION_OWNED, setEnvLine } from '../lib/env-file.js';
+import { applyDefaultOverrides, applyWizardAnswers, buildEnvReview, buildQuestionPlan, checkEnvCompleteness, generateVapidKeys, isQuestionActive, parseEnvBody, parseEnvExample, provisionEmailDefaults, } from '../lib/env-wizard.js';
 import { defaultEnvPath, readVercelToken } from '../lib/provision-preflight.js';
+import { readProvisionState } from '../lib/provision-state.js';
 import { pushEnvPlan, vercelProjectPath, VercelApiError, } from '../lib/vercel-env.js';
 // Re-exported so existing importers (and `cli/tests/unit/env-push.test.ts`) keep
 // resolving PROVISION_OWNED from this module after it moved to `lib/env-file.js`.
@@ -127,6 +128,8 @@ export function parseEnvWizardFlags(argv) {
         apply: argv.includes('--apply'),
         json: argv.includes('--json'),
         push: argv.includes('--push'),
+        review: argv.includes('--review'),
+        genVapid: argv.includes('--gen-vapid'),
     };
 }
 function readEnvExamplePlan(rootDir) {
@@ -136,9 +139,25 @@ function readEnvExamplePlan(rootDir) {
     }
     return buildQuestionPlan(parseEnvExample(readFileSync(examplePath, 'utf8')));
 }
+/**
+ * Read the question plan and override defaults with what provision already
+ * configured (e.g. EMAIL_PROVIDER → `resend` once the DNS/Resend step ran), so the
+ * wizard never re-asks a decision provision already made. A missing/corrupt state
+ * file is non-fatal — the plan just falls back to the `.env.example` defaults.
+ */
+function planWithProvisionDefaults(rootDir) {
+    let state = null;
+    try {
+        state = readProvisionState(rootDir);
+    }
+    catch {
+        state = null;
+    }
+    return applyDefaultOverrides(readEnvExamplePlan(rootDir), provisionEmailDefaults(state));
+}
 /** `factory env wizard --plan [--json]` — emit the question plan. */
 export function runEnvWizardPlan(flags, rootDir = process.cwd()) {
-    const questions = readEnvExamplePlan(rootDir);
+    const questions = planWithProvisionDefaults(rootDir);
     if (flags.json) {
         process.stdout.write(`${JSON.stringify({ questions }, null, 2)}\n`);
         return;
@@ -176,6 +195,11 @@ export async function runEnvWizardApply(flags, rootDir = process.cwd(), deps = {
     const answers = parsed.answers ?? {};
     const written = applyWizardAnswers(rootDir, answers);
     console.log(`✔ Escribí ${written.length} variable(s) en \`.env.local\`.`);
+    // Completeness guards (OAuth creds, VAPID) — warn, never block the write. Read
+    // the resolved file so an already-present cred (from provision) counts as set.
+    const finalEnv = parseEnvBody(readFileSync(path.join(rootDir, '.env.local'), 'utf8'));
+    for (const w of checkEnvCompleteness(finalEnv))
+        console.log(`⚠ ${w}`);
     const shouldPush = flags.push || parsed.push === true;
     if (!shouldPush) {
         console.log('ℹ️  Para subirlas a Vercel cuando quieras: `pnpm env:push`.');
@@ -184,3 +208,71 @@ export async function runEnvWizardApply(flags, rootDir = process.cwd(), deps = {
     const push = deps.push ?? ((dir) => runEnvPush({ dryRun: false }, dir));
     await push(rootDir);
 }
+/**
+ * `factory env wizard --review [--json]` — a secret-safe summary of the resolved
+ * `.env.local`. Non-secret values are shown; secret values are masked; empty ones
+ * are flagged. This is what the guided flow shows the dev at the end (the agent
+ * NEVER echoes raw secrets) — the dev opens `.env.local` to see the full values.
+ */
+export function runEnvWizardReview(flags, rootDir = process.cwd()) {
+    const localPath = path.join(rootDir, '.env.local');
+    if (!existsSync(localPath)) {
+        throw new CLIError('No encontré `.env.local`. Corre el wizard (`factory env wizard`) primero.');
+    }
+    const body = readFileSync(localPath, 'utf8');
+    const answers = parseEnvBody(body);
+    const questions = planWithProvisionDefaults(rootDir).filter((q) => isQuestionActive(q, answers));
+    const rows = buildEnvReview(questions, body);
+    const warnings = checkEnvCompleteness(answers);
+    if (flags.json) {
+        process.stdout.write(`${JSON.stringify({ rows, warnings }, null, 2)}\n`);
+        return;
+    }
+    console.log('Configuración de `.env.local` (los secretos van enmascarados):\n');
+    let section = '';
+    for (const row of rows) {
+        if (row.section !== section) {
+            section = row.section;
+            console.log(`## ${section}`);
+        }
+        const flag = row.status === 'empty' ? ' ⚠' : '';
+        console.log(`  ${row.key} = ${row.display}${flag}`);
+    }
+    if (warnings.length) {
+        console.log('\nAvisos:');
+        for (const w of warnings)
+            console.log(`  ⚠ ${w}`);
+    }
+    console.log('\nAbre `.env.local` para ver los valores completos (los secretos no se imprimen).');
+}
+/**
+ * `factory env wizard --gen-vapid` — generate a VAPID keypair and write it to
+ * `.env.local`. The private key is a SECRET: it is written to the file (0600) and
+ * NEVER printed. The public key is public by design, so it is safe to echo.
+ */
+export function runEnvWizardGenVapid(rootDir = process.cwd()) {
+    const localPath = path.join(rootDir, '.env.local');
+    const examplePath = path.join(rootDir, '.env.example');
+    const basePath = existsSync(localPath) ? localPath : examplePath;
+    if (!existsSync(basePath)) {
+        throw new CLIError('No encontré `.env.local` ni `.env.example` para escribir las llaves VAPID.');
+    }
+    const { publicKey, privateKey } = generateVapidKeys();
+    let body = readFileSync(basePath, 'utf8');
+    body = setEnvLine(body, 'NEXT_PUBLIC_VAPID_PUBLIC_KEY', publicKey);
+    body = setEnvLine(body, 'VAPID_PRIVATE_KEY', privateKey);
+    // Seed a sensible VAPID_SUBJECT (push contact) from EMAIL_FROM if it's unset.
+    const env = parseEnvBody(body);
+    const subjectMissing = !env['VAPID_SUBJECT'];
+    if (subjectMissing) {
+        const from = env['EMAIL_FROM'];
+        body = setEnvLine(body, 'VAPID_SUBJECT', from ? `mailto:${from}` : 'mailto:admin@example.com');
+    }
+    writeFileSync(localPath, body, 'utf8');
+    chmodSync(localPath, 0o600); // holds VAPID_PRIVATE_KEY → owner-only.
+    console.log('✔ Llaves VAPID generadas y escritas a `.env.local` (la privada queda oculta).');
+    console.log(`  NEXT_PUBLIC_VAPID_PUBLIC_KEY=${publicKey}`);
+    if (subjectMissing && !env['EMAIL_FROM']) {
+        console.log('  ℹ️  Revisa VAPID_SUBJECT — puse un placeholder (correo de contacto para push).');
+    }
+}

package/dist/commands/provision.js

@@ -29,7 +29,7 @@ import { apexZoneOf, CloudflareApiError, CLOUDFLARE_API_BASE, ensureCnameRecord,
 import { createDevelopBranch, createNeonProject, createProjectApiKey, deleteNeonApiKeysByName, deleteNeonProject, getConnectionUri, listNeonBranches, listNeonProjects, NeonApiError, NEON_API_BASE, NEON_DEVELOP_BRANCH, } from '../lib/neon-api.js';
 import { defaultEnvPath, readVercelToken, runProvisionPreflight, } from '../lib/provision-preflight.js';
 import { addVercelDomain, buildEnvPlan, createVercelProject, generateAuthSecret, generateMfaEncryptionKey, getLinkedRepoId, getVercelDomainStatus, GitHubAppNotInstalledError, linkGitRepo, listVercelProjects, patchProjectSettings, pushEnvPlan, removeVercelDomain, triggerDeployment, upsertEnvVar, listEnvVars, VercelApiError, writeVercelProjectJson, } from '../lib/vercel-env.js';
-import { writeEnvLocal } from '../lib/env-file.js';
+import { writeE2eLocalCreds, writeEnvLocal } from '../lib/env-file.js';
 import { adoptState, ADOPT_UNKNOWN, clearProvisionState, clearState, hasProvisionState, isServiceComplete, PROVISION_DIR, PROVISION_STATE_FILE, readDestroyTarget, readProvisionState, writeProvisionState, } from '../lib/provision-state.js';
 /**
  * The THREE GitHub Secrets the E2E runner (`pnpm test:e2e` → `e2e-runner.ts` +
@@ -255,10 +255,53 @@ function deriveProjectName(flags, rootDir) {
     // `repo TimeKast/team_ldqH... no existe` error. Validate it like an explicit slug.
     // Lowercased so a dir created with mixed case (e.g. `Edmond/`) yields a valid slug
     // instead of being rejected for the uppercase — matches the `new` normalization.
+    // No `--slug`: prefer the slug documented in project-config.md over the directory
+    // name, so the provisioned domains/project match the project's identity doc rather
+    // than an incidental dir/repo name (e.g. `factory-test` vs a documented
+    // `factory-testlab`). Best-effort: fall back to the dir on any miss.
     const fromDir = basename(rootDir).toLowerCase();
+    const fromConfig = readConfigSlug(rootDir);
+    if (fromConfig && fromConfig !== fromDir) {
+        console.log(`ℹ️  Slug tomado de project-config.md: \`${fromConfig}\` ` +
+            `(el directorio es \`${fromDir}\`). Pasa \`--slug\` para forzar otro.`);
+        return fromConfig; // readConfigSlug already validated it as a subdomain label
+    }
     assertValidSubdomainSlug(fromDir);
     return fromDir;
 }
+/**
+ * Best-effort read of the documented slug from `project/planning/project-config.md`.
+ * Matches both the table form (`| **Slug** | my-app |`) and prose (`**Slug:** my-app`).
+ * Returns `null` when the file is absent/unparsable or the value isn't a valid
+ * subdomain label — the caller then falls back to the directory name.
+ */
+export function readConfigSlug(rootDir) {
+    const configPath = join(rootDir, 'project', 'planning', 'project-config.md');
+    if (!existsSync(configPath))
+        return null;
+    let text;
+    try {
+        text = readFileSync(configPath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const line = text.split('\n').find((l) => /(^|\|)\s*\**\s*Slug\b/i.test(l));
+    if (!line)
+        return null;
+    // Drop everything up to and including "Slug", strip the markdown separators, then
+    // take the WHOLE first token that remains and validate it as a unit (so a value
+    // like `not_a_slug` is rejected outright, not truncated to a valid-looking prefix).
+    const token = line
+        .slice(line.search(/Slug\b/i) + 4)
+        .replace(/[*|:]/g, ' ')
+        .trim()
+        .split(/\s+/)[0];
+    if (!token)
+        return null;
+    const slug = token.toLowerCase();
+    return isValidSubdomainSlug(slug) ? slug : null;
+}
 /**
  * Read the VALUE of `NEON_API_KEY` (the shared org key) from the rail
  * (`~/.claude/.env`). Mirrors `readVercelToken`: split on the FIRST `=`, strip a
@@ -701,6 +744,14 @@ export async function provisionVercel(rootDir, state, teamId, deps = {}) {
     else if (envLocal === 'skipped') {
         console.log('  ⏭ .env.local ya existía (no se sobrescribe — usa --force para regenerarlo)');
     }
+    // Local E2E creds: write NEON_API_KEY (the org key from the rail — already on the
+    // dev's host) + NEON_PROJECT_ID so `pnpm test:e2e` runs locally with zero manual
+    // `setup:e2e`. Both are PROVISION_OWNED → never pushed to Vercel. Safe on a skipped
+    // `.env.local` (setEnvLine touches only these two keys). The key value is never printed.
+    if (state.neon?.projectId &&
+        writeE2eLocalCreds(rootDir, state.neon.projectId, readNeonApiKey(envPath))) {
+        console.log('  ＋ .env.local (NEON_API_KEY · NEON_PROJECT_ID — para `pnpm test:e2e` local)');
+    }
     // `pnpm install` the derived dir (issue §4). A missing package.json (non-Node
     // derivative) is reported, NOT fatal (issue §8).
     if (existsSync(join(rootDir, 'package.json'))) {
@@ -2424,6 +2475,18 @@ export async function runProvision(flags) {
         // this write keeps the baseline durable for them too.
         writeProvisionState(rootDir, runState);
     }
+    // 5a. Retry the E2E GitHub Secrets if Neon recorded them pending. Neon runs BEFORE
+    //     the git substrate, so on a fresh bootstrap the repo may not exist yet when it
+    //     first tries `gh secret set` → it records `apiKeySecretPending` (non-fatal)
+    //     instead of aborting. Now that the substrate confirmed the repo
+    //     (`runState.github.repo`), re-run Neon: it is idempotent (skips the project +
+    //     branch create) and re-mints the unpersisted key to store the three secrets.
+    //     Without this, CI E2E stays credential-less until a MANUAL `--resume`.
+    if (!flags.dryRun && runState.neon?.apiKeySecretPending && runState.github?.repo) {
+        console.log('\n↻ Reintentando los secrets de E2E ahora que el repo existe...');
+        await provisionNeon(rootDir, runState);
+        writeProvisionState(rootDir, runState);
+    }
     // 5b. Client domain (PROV-006) — runs AFTER the services so the Vercel project
     //     (and the interim domains) already exist. Standalone patch or post-services.
     if (hasDomain) {

package/dist/index.js

@@ -11,7 +11,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { CLIError } from './lib/cli-error.js';
 import { parseAddFlags, runAdd } from './commands/add.js';
-import { parseEnvPushFlags, parseEnvWizardFlags, runEnvPush, runEnvWizardApply, runEnvWizardPlan, } from './commands/env.js';
+import { parseEnvPushFlags, parseEnvWizardFlags, runEnvPush, runEnvWizardApply, runEnvWizardGenVapid, runEnvWizardPlan, runEnvWizardReview, } from './commands/env.js';
 import { parseInviteAdminFlags, runInviteAdmin } from './commands/invite-admin.js';
 import { envWizardFlow } from './tui/env-wizard-flow.js';
 import { parseDoctorFlags, runDoctor, runLauncherDoctor } from './commands/doctor.js';
@@ -250,6 +250,14 @@ async function main(argv) {
                     runEnvWizardPlan(wflags);
                     return;
                 }
+                if (wflags.review) {
+                    runEnvWizardReview(wflags);
+                    return;
+                }
+                if (wflags.genVapid) {
+                    runEnvWizardGenVapid();
+                    return;
+                }
                 if (wflags.apply) {
                     await runEnvWizardApply(wflags);
                     return;

package/dist/lib/atomic-swap.js

@@ -26,21 +26,21 @@ import { CLIError } from './cli-error.js';
 import { CLAUDE_MD_FILE, TIMEKAST_DIR } from './constants.js';
 import { parseLockfile } from './lockfile.js';
 /** Roots a manifest path may live under (mirrors `profiles.json#track`). */
-const ALLOWED_ROOTS = ['.claude/', 'scripts/'];
+const ALLOWED_ROOTS = ['.claude/', 'scripts/', '.husky/'];
 /**
  * Reject a manifest path that is unsafe to write: absolute, escaping via `..`, or
- * outside the tracked scope (`.claude/**`, `scripts/**`, `CLAUDE.md`). A correct
+ * outside the tracked scope (`.claude/**`, `scripts/**`, `CLAUDE.md`, `.husky/**`). A correct
  * release never produces these — this guards a mispublished/tampered tarball from
  * writing `src/` or escaping the repo root. Separator-agnostic (Windows-safe).
  */
-function assertSafeTrackedPath(rel) {
+export function assertSafeTrackedPath(rel) {
     const segments = rel.split(/[\\/]/);
     if (rel.length === 0 || path.isAbsolute(rel) || segments.includes('..')) {
         throw new CLIError(`El manifest declara un path inseguro \`${rel}\` (absoluto o con \`..\`); no se tocó nada.`);
     }
     const tracked = rel === CLAUDE_MD_FILE || ALLOWED_ROOTS.some((root) => rel.startsWith(root));
     if (!tracked) {
-        throw new CLIError(`El manifest declara \`${rel}\`, fuera del scope rastreado (\`.claude/\`, \`scripts/\`, \`CLAUDE.md\`). ` +
+        throw new CLIError(`El manifest declara \`${rel}\`, fuera del scope rastreado (\`.claude/\`, \`scripts/\`, \`CLAUDE.md\`, \`.husky/\`). ` +
             'El release está mal construido; no se tocó nada.');
     }
 }

package/dist/lib/env-file.js

@@ -30,6 +30,11 @@ export const PROVISION_OWNED = new Set([
     // (rpID must match the env's host) or the at-rest TOTP crypto.
     'MFA_ENCRYPTION_KEY',
     'WEBAUTHN_RP_ID',
+    // LOCAL-ONLY E2E credentials (like DATABASE_URL_MAIN): the E2E runner reads them
+    // from `.env.local` to spin an isolated Neon branch per run. CI gets them as GitHub
+    // Secrets; they must NEVER reach Vercel (a day-2 push would leak the Neon key).
+    'NEON_API_KEY',
+    'NEON_PROJECT_ID',
 ]);
 /**
  * Replace the value of `KEY=...` in an env-file body, preserving every other line.
@@ -76,3 +81,26 @@ export function writeEnvLocal(rootDir, neon, opts = {}) {
     chmodSync(localPath, 0o600);
     return 'written';
 }
+/**
+ * Write the LOCAL E2E Neon credentials into `.env.local` so `pnpm test:e2e` runs on
+ * the dev's machine without a manual `setup:e2e`. The E2E runner reads NEON_API_KEY +
+ * NEON_PROJECT_ID from `.env.local` to spin an isolated branch per run. CI gets these
+ * as GitHub Secrets (a project-scoped key); locally we reuse the dev's ORG key from
+ * the rail (already on their host). Both stay LOCAL-ONLY (PROVISION_OWNED → never
+ * pushed to Vercel). Returns false (no-op) when the key/project id is missing or
+ * `.env.local` does not exist yet (`writeEnvLocal` creates it first). Safe on an
+ * existing file: `setEnvLine` only touches these two keys, preserving the rest.
+ */
+export function writeE2eLocalCreds(rootDir, projectId, apiKey) {
+    if (!apiKey || !projectId)
+        return false;
+    const localPath = join(rootDir, '.env.local');
+    if (!existsSync(localPath))
+        return false;
+    let body = readFileSync(localPath, 'utf8');
+    body = setEnvLine(body, 'NEON_PROJECT_ID', projectId);
+    body = setEnvLine(body, 'NEON_API_KEY', apiKey);
+    writeFileSync(localPath, body, 'utf8');
+    chmodSync(localPath, 0o600); // holds NEON_API_KEY → owner-only.
+    return true;
+}

package/dist/lib/env-wizard.js

@@ -10,6 +10,7 @@
  * (EMAIL_PROVIDER → its creds, the OAuth flags → their creds) are encoded as a
  * small `GATES` map — the one piece of domain knowledge the file can't express.
  */
+import { createECDH } from 'node:crypto';
 import { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { CLIError } from './cli-error.js';
@@ -182,3 +183,125 @@ export function applyWizardAnswers(rootDir, answers) {
     chmodSync(localPath, 0o600);
     return written;
 }
+// ─────────────────────────────────────────────────────────────────────────────
+// Guided-wizard helpers — the pieces the `tk-provision` skill (or the TUI) uses
+// to (a) pre-fill defaults from what provision already configured, (b) never leak
+// secret values, (c) auto-generate what a dev can't type, and (d) catch broken
+// setups (a provider flag on with empty creds). All pure over their inputs.
+// ─────────────────────────────────────────────────────────────────────────────
+/** True when `key`'s value is a secret (never printed in review/summary output). */
+export function isSecretKey(key) {
+    return SECRET_KEY.test(key);
+}
+/** Parse an env-file body into `{ KEY: value }` (unquoted), skipping comments/blanks. */
+export function parseEnvBody(body) {
+    const out = {};
+    for (const line of body.split('\n')) {
+        const trimmed = line.trimStart();
+        if (trimmed === '' || trimmed.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        if (key)
+            out[key] = unquote(line.slice(eq + 1));
+    }
+    return out;
+}
+/** Mask a value for display: secrets → `••••••••`, everything else verbatim. */
+export function maskValue(key, value) {
+    if (!value)
+        return value;
+    return isSecretKey(key) ? '••••••••' : value;
+}
+/** Override the `defaultValue` of any question whose key appears in `overrides`. */
+export function applyDefaultOverrides(questions, overrides) {
+    return questions.map((q) => (q.key in overrides ? { ...q, defaultValue: overrides[q.key] } : q));
+}
+/**
+ * Defaults derived from what provision already did. Provision wires Resend as part
+ * of its `dns` step (RESEND_API_KEY + EMAIL_FROM into Vercel); when the `dns` block
+ * exists in the state, the derivative's email IS Resend — so default the wizard to
+ * `resend`, closing the `.env.local` (none) ↔ Vercel (resend) drift. EMAIL_FROM
+ * stays the dev's to confirm. Structural typing keeps this module decoupled from
+ * the full `ProvisionState` shape.
+ */
+export function provisionEmailDefaults(state) {
+    return state?.dns ? { EMAIL_PROVIDER: 'resend' } : {};
+}
+/** OAuth providers wired in `.env.example`: a flag that reveals an id + secret. */
+const OAUTH_PROVIDERS = [
+    {
+        flag: 'NEXT_PUBLIC_AUTH_GOOGLE',
+        id: 'AUTH_GOOGLE_ID',
+        secret: 'AUTH_GOOGLE_SECRET',
+        label: 'Google',
+    },
+    {
+        flag: 'NEXT_PUBLIC_AUTH_GITHUB',
+        id: 'AUTH_GITHUB_ID',
+        secret: 'AUTH_GITHUB_SECRET',
+        label: 'GitHub',
+    },
+];
+/**
+ * Warn (do NOT block) about half-configured setups that would ship a broken app:
+ * an OAuth provider enabled with empty creds → broken login button; notifications
+ * enabled with no VAPID keys → dead push. Pure over the resolved env map.
+ */
+export function checkEnvCompleteness(env) {
+    const warnings = [];
+    for (const p of OAUTH_PROVIDERS) {
+        if (env[p.flag] !== 'true')
+            continue;
+        const missing = [p.id, p.secret].filter((k) => !env[k]);
+        if (missing.length) {
+            warnings.push(`Login con ${p.label} activado pero falta ${missing.join(' + ')} → el botón de login ` +
+                `quedará roto. Complétalas o pon ${p.flag}="false".`);
+        }
+    }
+    if (env['NEXT_PUBLIC_NOTIFICATIONS_ENABLED'] === 'true' &&
+        (!env['NEXT_PUBLIC_VAPID_PUBLIC_KEY'] || !env['VAPID_PRIVATE_KEY'])) {
+        warnings.push('Notificaciones activadas pero faltan las llaves VAPID → el push web no funcionará. ' +
+            'Corre `factory env wizard --gen-vapid` para generarlas.');
+    }
+    return warnings;
+}
+/**
+ * Generate a VAPID keypair (P-256, the Web Push standard) with `node:crypto` — no
+ * dependency on `web-push`. Public key = 65-byte uncompressed EC point (public by
+ * design, ships to the browser); private key = the 32-byte scalar (a SECRET —
+ * callers write it to `.env.local` and NEVER print it). Both base64url.
+ */
+export function generateVapidKeys() {
+    const ecdh = createECDH('prime256v1');
+    ecdh.generateKeys();
+    const priv = ecdh.getPrivateKey();
+    // Left-pad to a fixed 32 bytes (the scalar can be shorter when it has leading
+    // zero bytes) so the key is always the canonical VAPID length.
+    const priv32 = priv.length === 32 ? priv : Buffer.concat([Buffer.alloc(32 - priv.length), priv]);
+    return {
+        publicKey: ecdh.getPublicKey().toString('base64url'),
+        privateKey: priv32.toString('base64url'),
+    };
+}
+/**
+ * Build a secret-safe review of `.env.local` for the final "here's how your app is
+ * configured" summary. Secret values are masked; empty values are flagged. Callers
+ * pass the questions they want shown (typically the ACTIVE ones for the resolved env).
+ */
+export function buildEnvReview(questions, body) {
+    const env = parseEnvBody(body);
+    return questions.map((q) => {
+        const value = env[q.key] ?? '';
+        const status = value ? 'set' : 'empty';
+        return {
+            key: q.key,
+            section: q.section,
+            kind: q.kind,
+            status,
+            display: status === 'empty' ? '(sin configurar)' : maskValue(q.key, value),
+        };
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.16.0",
+  "version": "1.17.1",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",